code:
#pragma once
#include <Utils/IModule.hpp>
#include <Utils/Types.hpp>
#include <Utils/Hook.hpp>
#include <Driver/CtrlDriver.hpp>

extern "C"
{
    #include <sys/eventhandler.h>
    #include <sys/module.h>
    #include <sys/ioccom.h>
    #include <sys/sysproto.h>
    #include <sys/sysent.h>
};

struct proc;
struct mtx;

struct dynlib_dlsym_args {
    int id;
    char* name;
    uint64_t* result;
};

struct entrypointhook_header {
    uint32_t magic;
    uint64_t entrypoint;
    uint32_t epdone;
    uint64_t sceSysmodulePreloadModuleForLibkernel;
    uint64_t fakeReturnAddress;
} __attribute__((packed));

/////////////////////////////////////////
// Substitute Parameter (Don't forget to update library !)
/////////////////////////////////////////

#define SUBSTITUTE_IOCTL_BASE   'S'
#define SUBSTITUTE_MAX_NAME 255 // Max lenght for name
#define SUBSTITUTE_MAIN_MODULE "" // Define the main module
#define SUBSTITUTE_MAX_HOOKS 100 // Max possible hooks (all process)
#define SUBSTITUTE_MAX_CHAINS 50 // Max possible function in chains

/////////////////////////////////////////
// Enumeration
/////////////////////////////////////////

enum HookType {
    HOOKTYPE_IAT,
    HOOKTYPE_JMP
};

enum {
    SUBSTITUTE_IAT_NAME = 0,
    SUBSTITUTE_IAT_NIDS = 1
};

enum {
    SUBSTITUTE_STATE_DISABLE = 0,
    SUBSTITUTE_STATE_ENABLE = 1,
    SUBSTITUTE_STATE_UNHOOK = 2
};

enum SubstituteError {
    SUBSTITUTE_OK       =  0,
    SUBSTITUTE_BAD_ARGS = -1,
    SUBSTITUTE_INVALID  = -2,
    SUBSTITUTE_BADLOGIC = -3,
    SUBSTITUTE_NOTFOUND = -4,
    SUBSTITUTE_NOMEM    = -5
};

/////////////////////////////////////////
// Kernel structure
/////////////////////////////////////////

struct SubstituteJmp {
    void* orig_addr;
    void* jmpto;
    char* backupData;
    size_t backupSize;
    bool enable;
};

struct SubstituteIAT {
    void* jmpslot_address;
    void* original_function;
    uint64_t* uap_chains;
};

struct SubstituteHook {
    struct proc* process;
    HookType hook_type;
    struct SubstituteJmp jmp;
    struct SubstituteIAT iat;
};

/////////////////////////////////////////
// IOCTL Wrapper
/////////////////////////////////////////

struct substitute_state_hook {
    int hook_id;
    int state;
    struct substitute_hook_uat* chain;
    int result;
};

struct substitute_hook_iat {
    int hook_id;
    char name[SUBSTITUTE_MAX_NAME];
    char module_name[SUBSTITUTE_MAX_NAME];
    int flags;
    void* hook_function;
    struct substitute_hook_uat* chain;
};

struct substitute_hook_jmp {
    int hook_id;
    void* original_function;
    void* hook_function;
};

/////////////////////////////////////////
// Userland structure Information & Chain
/////////////////////////////////////////

struct substitute_hook_uat {
    int hook_id;
    void* hook_function;
    void* original_function;
    struct substitute_hook_uat* next;
};

/////////////////////////////////////////
// IOCTL Definition
/////////////////////////////////////////

#define SUBSTITUTE_HOOK_IAT _IOC(IOC_INOUT, SUBSTITUTE_IOCTL_BASE, 1, sizeof(struct substitute_hook_iat))
#define SUBSTITUTE_HOOK_JMP _IOC(IOC_INOUT, SUBSTITUTE_IOCTL_BASE, 2, sizeof(struct substitute_hook_jmp))
#define SUBSTITUTE_HOOK_STATE _IOC(IOC_INOUT, SUBSTITUTE_IOCTL_BASE, 3, sizeof(struct substitute_state_hook))

/////////////////////////////////////////
// Class Definition
/////////////////////////////////////////

namespace Mira
{
    namespace Plugins
    {
        class Substitute : public Utils::IModule
        {
        private:
            // Hook management
            struct mtx hook_mtx;
            SubstituteHook hooks[SUBSTITUTE_MAX_HOOKS];

        public:
            // Syscall hook (Original pointer)
            void* sys_dynlib_dlsym_p;

            // Plugin Base
            Substitute();
            virtual ~Substitute();
            virtual bool OnLoad() override;
            virtual bool OnUnload() override;
            virtual bool OnSuspend() override;
            virtual bool OnResume() override;

            virtual bool OnProcessExecEnd(struct proc*) override;
            virtual bool OnProcessExit(struct proc*) override;

            static Substitute* GetPlugin();

            // Hook memory utility
            SubstituteHook* GetHookByID(int hook_id);
            SubstituteHook* AllocateHook(int* hook_id);
            void FreeHook(int hook_id);

            // Chain Utility
            bool  FindJmpslotSimilarity(struct proc* p, void* jmpslot_addr, int* hook_id);
            int   FindPositionByChain(uint64_t* chains, uint64_t chain);
            void* FindLastChainOccurence(uint64_t* chains, int* position);

            // Hook mechanics
            int DisableHook(struct proc* p, int hook_id);
            int EnableHook(struct proc* p, int hook_id);
            int Unhook(struct proc* p, int hook_id, struct substitute_hook_uat* chain);
            int HookJmp(struct proc* p, void* original_address, void* hook_function);
            int HookIAT(struct proc* p, struct substitute_hook_uat* chain, const char* module_name, const char* name, int32_t flags, void* hook_function);
            void CleanupProcessHook(struct proc* p);
            void CleanupAllHook();

            // SCE Module Utility
            uint64_t FindJmpslotAddress(struct proc* p, const char* module_name, const char* name, int32_t flags);
            void*    FindOriginalAddress(struct proc* p, const char* name, int32_t flags);

            // Utility
            void     LoadAllPrx(struct thread* td, const char* folder_path);

            // IOCTL Function
            static int OnIoctl_HookIAT(struct thread* td, struct substitute_hook_iat* uap);
            static int OnIoctl_HookJMP(struct thread* td, struct substitute_hook_jmp* uap);
            static int OnIoctl_StateHook(struct thread* td, struct substitute_state_hook* uap);
            static int OnIoctl(struct cdev* p_Device, u_long p_Command, caddr_t p_Data, int32_t p_FFlag, struct thread* p_Thread);

        protected:
            // Event to trigger
            static int Sys_dynlib_dlsym_hook(struct thread* td, struct dynlib_dlsym_args* uap);
        };
    }
}


code:
#include "Substitute2.hpp"

#include <Utils/Logger.hpp>

extern "C"
{
    #include <sys/proc.h>
};

using namespace Mira::Plugins;

bool Substitute2::OnProcessExecEnd(struct proc* p_Process)
{
    // Validate the process
    if (p_Process == nullptr)
    {
        WriteLog(LL_Error, "invalid process.");
        return false;
    }

    // Check the process name
    if (strcmp("eboot.bin", p_Process->p_comm) != 0)
        return true;

    // Check the title id's against the supported
    const char* s_TitleId = &p_Process->p_unk348[0x58];
    if (s_TitleId == nullptr)
        return false;

    // Get the main thread
    auto s_MainThread = p_Process->p_threads.tqh_first;
    if (s_MainThread == nullptr)
    {
        WriteLog(LL_Error, "main thread not found.");
        return false;
    }

    // Get the process name

    // Mount sub folder to the game path

    return true;
}

bool Substitute2::OnProcessExit(struct proc* p_Process)
{
    return true;
}

bool Substitute2::GetTitlePath(SubstituteFlags p_Flags, const char* p_TitleId, const char*& p_OutPath)
{
    return false;
}

repo_name: veiledmerc/mira

license: mit


code:
#pragma once
#include <Utils/IModule.hpp>

namespace Mira
{
    namespace Plugins
    {
        class Substitute2 : public Utils::IModule
        {
        private:
            typedef enum SubstituteFlags_t
            {
                SF_NONE = 0,
                SF_USB = 1 << 1,
                SF_NET = 1 << 2,
                SF_USER = 1 << 3,
            } SubstituteFlags;
        public:
            virtual bool OnProcessExecEnd(struct proc* p_Process) override;
            virtual bool OnProcessExit(struct proc* p_Process) override;

        protected:
            bool GetTitlePath(SubstituteFlags p_Flags, const char* p_TitleId, const char*& p_OutPath);
        };
    }
}


code:
// This is an open source non-commercial project. Dear PVS-Studio, please check it.
// PVS-Studio Static Code Analyzer for C, C++, C#, and Java: http://www.viva64.com

#include "SyscallGuardPlugin.hpp"
#include <Utils/Kdlsym.hpp>
#include <Utils/Kernel.hpp>
#include <Utils/Logger.hpp>
#include <Utils/_Syscall.hpp>

#include <Mira.hpp>
#include <Plugins/PluginManager.hpp>

using namespace Mira::Plugins;

SyscallGuard::SyscallGuard() :
    m_SyscallCount(0),
    m_CallStatuses(nullptr),
    m_SyCalls(nullptr)
{
    // Ensure that this only takes up 1 byte
    static_assert(sizeof(CallStatus) == 1, "CallStatus size incorrect");

    // Get the sysvec
    auto s_SysVec = (struct sysentvec*)kdlsym(self_orbis_sysvec);
    if (s_SysVec == nullptr)
    {
        WriteLog(LL_Error, "could not get the sysvec");
        return;
    }

    // Get the syscall count
    auto s_SyscallCount = s_SysVec->sv_size;

    // Ensure that we only use up to 1MiB of size
    if (s_SyscallCount > SyscallCount_Max)
    {
        WriteLog(LL_Error, "syscall count (%d) > max (%d), check kernel or increase limits.", s_SyscallCount, SyscallCount_Max);
        return;
    }

    // Update the syscall count
    m_SyscallCount = s_SyscallCount;
    WriteLog(LL_Info, "Current syscall count: (%d).", m_SyscallCount);

    // Allocate the call statuses
    m_CallStatuses = new CallStatus[m_SyscallCount];
    if (m_CallStatuses == nullptr)
    {
        WriteLog(LL_Error, "could not allocate call statuses");
        m_SyscallCount = 0;
        return;
    }

    m_SyCalls = new sy_call_t*[m_SyscallCount];
    if (m_SyCalls == nullptr)
    {
        WriteLog(LL_Error, "Could not allocate sy_call table.");
        m_SyscallCount = 0;
        return;
    }
    memset(m_SyCalls, 0, sizeof(void*) * m_SyscallCount);

    // TODO: Check to see if users have all syscalls enabled

    // Start with a all disabled
    for (auto i = 0; i < s_SyscallCount; ++i)
        m_CallStatuses[i] = CallStatus::Status_Disabled;

    // Backup the current syscall table
    for (auto i = 0; i < m_SyscallCount; ++i)
        m_SyCalls[i] = s_SysVec->sv_table[i].sy_call;

    // Replace all syscall handlers with our own
    for (auto i = 0; i < m_SyscallCount; ++i)
        s_SysVec->sv_table[i].sy_call = SyscallGuard::SyscallHandler;

    WriteLog(LL_Info, "syscall guard initialized");
}

SyscallGuard::~SyscallGuard()
{

}

bool SyscallGuard::SetReservedSyscall(int p_SyscallNumber, sy_call_t p_Call)
{
    if (p_Call == nullptr)
        return false;

    if (p_SyscallNumber <= NOSYS || p_SyscallNumber > m_SyscallCount)
        return false;

    if (m_CallStatuses == nullptr)
        return false;

    if (m_SyCalls == nullptr)
        return false;

    m_CallStatuses[p_SyscallNumber] = CallStatus::Status_Reserved;
    m_SyCalls[p_SyscallNumber] = p_Call;

    return true;
}

int SyscallGuard::SyscallHandler(struct thread * p_Thread, void * p_Uap)
{
    // Get the syscall number from eax (hopefully)?
    int s_SyscallNumber = -1;
    asm(
        "mov %%eax, %0"
        : "=r"(s_SyscallNumber) // Output
        :                       // Input
        :                       // Clobbered
    );

    WriteLog(LL_Info, "syscall (%d) called.", s_SyscallNumber);

    // Get the syscall guard reference
    auto s_SyscallGuard = static_cast<Plugins::SyscallGuard*>(Mira::Framework::GetFramework()->GetPluginManager()->GetSyscallGuard());
    if (s_SyscallGuard == nullptr)
    {
        WriteLog(LL_Error, "could not get the syscall guard.");
        return -EPERM;
    }

    // Get the main mira process
    auto s_MiraProcess = Mira::Framework::GetFramework()->GetInitParams()->process;
    if (s_MiraProcess == nullptr)
    {
        WriteLog(LL_Error, "could not get the mira process.");
        return -EPERM;
    }

    // Validate that our syscall number is valid
    if (s_SyscallNumber < NOSYS || s_SyscallNumber >= s_SyscallGuard->m_SyscallCount)
    {
        WriteLog(LL_Error, "invalid syscall called (%d).", s_SyscallNumber);
        return -EPERM;
    }

    // Get the call from our list
    auto s_Call = s_SyscallGuard->m_SyCalls[s_SyscallNumber];
    if (s_Call == nullptr)
    {
        WriteLog(LL_Error, "could not get a sy_call for syscall (%d).", s_SyscallNumber);
        return -EPERM;
    }

    // Get the status
    auto s_Status = s_SyscallGuard->m_CallStatuses[s_SyscallNumber];
    switch (s_Status)
    {
    case CallStatus::Status_Reserved:
        // Check to make sure that reserved syscalls are only called by mira
        if (p_Thread->td_proc != s_MiraProcess)
        {
            WriteLog(LL_Error, "syscall (%d) was called by a non-whitelisted process (%d) (%s).", s_SyscallNumber, p_Thread->td_proc->p_pid, p_Thread->td_proc->p_comm);
            return -EPERM;
        }
        break;
    case CallStatus::Status_Enabled:
        // Do nothing, allow
        break;
    case CallStatus::Status_Disabled:
        WriteLog(LL_Error, "syscall (%d) disabled.", s_SyscallNumber);
        return -EPERM;
    default:
        WriteLog(LL_Error, "invalid syscall (%d) status (%d).", s_SyscallNumber, s_Status);
        return -EPERM;
    }

    // Call and return the original call (or replaced in case of reserved)
    return s_Call(p_Thread, p_Uap);
}


code:
#pragma once
#include <Utils/Types.hpp>
#include <Utils/IModule.hpp>
#include <Utils/Hook.hpp>

extern "C"
{
    #include <sys/param.h>
    #include <sys/proc.h>
    #include <sys/sysent.h>
};

namespace Mira
{
    namespace Plugins
    {
        enum class CallStatus : uint8_t
        {
            Status_Disabled,
            Status_Reserved,
            Status_Enabled,
            Status_COUNT
        };

        class SyscallGuard :
            public Mira::Utils::IModule
        {
        private:
            uint32_t m_SyscallCount;
            CallStatus* m_CallStatuses;
            sy_call_t** m_SyCalls;

            enum { SyscallCount_Max = 1024 };

        public:
            SyscallGuard();
            virtual ~SyscallGuard();

            virtual bool OnLoad() { return true; }
            virtual bool OnUnload() { return true; }
            virtual bool OnSuspend() { return true; }
            virtual bool OnResume() { return true; }

            bool SetReservedSyscall(int p_SyscallNumber, sy_call_t p_Call);

        protected:
            static int SyscallHandler(struct thread * p_Thread, void * p_Uap);
        };
    }
}


code:
// This is an open source non-commercial project. Dear PVS-Studio, please check it.
// PVS-Studio Static Code Analyzer for C, C++, C#, and Java: http://www.viva64.com

#include "TTYRedirector.hpp"

#include <Utils/Kdlsym.hpp>
#include <Utils/Logger.hpp>
#include <Mira.hpp>
#include <Plugins/PluginManager.hpp>

#include <sys/conf.h>

using namespace Mira::Plugins;

TTYRedirector::TTYRedirector() :
m_DeciTTYWrite_orig(nullptr)
{
}

TTYRedirector::~TTYRedirector()
{
}

bool TTYRedirector::OnLoad()
{
    cpu_disable_wp();
    m_DeciTTYWrite_orig = *(void**)(kdlsym(printf_hook));
    *(void**)(kdlsym(printf_hook)) = reinterpret_cast<void*>(OnDeciTTYWrite);
    cpu_enable_wp();

    WriteLog(LL_Info, "TTY Redirection enabled.");
    return true;
}

bool TTYRedirector::OnUnload()
{
    if (m_DeciTTYWrite_orig) {
        cpu_disable_wp();
        *(void**)(kdlsym(printf_hook)) = m_DeciTTYWrite_orig;
        cpu_enable_wp();
    }

    WriteLog(LL_Info, "TTY Redirection disabled.");
    return true;
}

bool TTYRedirector::OnSuspend()
{
    return true;
}

bool TTYRedirector::OnResume()
{
    return true;
}

int TTYRedirector::OnDeciTTYWrite(struct cdev* dev, struct uio* uio, int ioflag) {
   struct uio* cloned_uio = NULL;
   int ret;

   auto cloneuio = (struct uio*(*)(struct uio* uiop))kdlsym(cloneuio);
   auto console_write = (int(*)(struct cdev* dev, struct uio* uio, int ioflag))kdlsym(console_write);
   auto deci_tty_write = (int(*)(struct cdev* dev, struct uio* uio, int ioflag))kdlsym(deci_tty_write);
   auto M_IOV = (struct malloc_type*)kdlsym(M_IOV);
   auto console_cdev = (struct cdev**)kdlsym(console_cdev);
   auto free = (void(*)(void* addr, struct malloc_type* type))kdlsym(free);

   cloned_uio = cloneuio(uio);

   ret = deci_tty_write(dev, uio, ioflag);

   if (cloned_uio) {
       if (*console_cdev)
           console_write(*console_cdev, cloned_uio, ioflag);
       free(cloned_uio, M_IOV);
   }

   return ret;
}


code:
// This is an open source non-commercial project. Dear PVS-Studio, please check it.
// PVS-Studio Static Code Analyzer for C, C++, C#, and Java: http://www.viva64.com

#pragma once
#include <Utils/IModule.hpp>
#include <Utils/Types.hpp>
#include <Utils/Hook.hpp>

namespace Mira
{
    namespace Plugins
    {
        class TTYRedirector : public Utils::IModule
        {
        private:
            void* m_DeciTTYWrite_orig;

        public:
            TTYRedirector();
            virtual ~TTYRedirector();

            virtual bool OnLoad() override;
            virtual bool OnUnload() override;
            virtual bool OnSuspend() override;
            virtual bool OnResume() override;

        protected:
            static int OnDeciTTYWrite(struct cdev* dev, struct uio* uio, int ioflag);
        };
    }
}


code:
#pragma once

extern "C"
{
    #include <sys/stdint.h>
};

typedef struct _TrainerEntry
{
    enum { MaxTitleLength = 32 };

    typedef enum _EntryType : uint32_t
    {
        Boolean,
        Byte_1,
        Byte_2,
        Byte_4,
        Byte_8,
    } EntryType;

    EntryType Type;
    bool Enabled;
    uint8_t Padding[3];
    char Title[MaxTitleLength];

    // Ghetto hack for conversions
    union
    {
        uint8_t Data[8];
        bool AsBool;
        int8_t AsInt8;
        uint8_t AsUInt8;
        int16_t AsInt16;
        uint16_t AsUInt16;
        int32_t AsInt32;
        uint32_t AsUInt32;
        int64_t AsInt64;
        uint64_t AsUInt64;
        float AsSingle;
        double AsDouble;
    };
} TrainerEntry;
static_assert(sizeof(TrainerEntry) == 48);

typedef struct _TrainerTitleId
{
    enum { MaxTitleIdLength = 8 };

    char TitleId[MaxTitleIdLength];
    uint8_t MajorVersion;
    uint8_t MinorVersion;
} TrainerTitleId;

typedef struct _TrainerHeaderV1
{
    enum
    {
        MaxNameLength = 64,
        MaxDescriptionLength = 1024,
        MaxAuthorLength = 256,
        MaxTitleIdCount = 8,
        MaxTitleIdLength = 8,
    };

    // Total header size (including entries)
    uint32_t Size;

    // Trainer major version
    uint8_t MajorVersion;

    // Trainer minor version
    uint8_t MinorVersion;

    // Is this trainer enabled (even if it's loaded)
    bool Enabled;

    // Should the trainer re-load the values
    bool NeedsUpdate;

    // Name of the trainer
    char Name[MaxNameLength];

    // Description of the trainer
    char Description[MaxDescriptionLength];

    // Author(s) of the trainer
    char Author[MaxAuthorLength];

    // Total supported title id's (up to MaxTitleIdCount)
    TrainerTitleId TitleIds[MaxTitleIdCount];

    // Variable length trainer entries
    TrainerEntry Entries[];

} TrainerHeaderV1;

typedef struct _TrainerHeaderV2
{
    uint32_t Size;

} TrainerHeaderV2;

typedef struct _TrainerHeader
{
    uint64_t Version;
    union
    {
        // We want to be able to support multiple versions of trainers as needs/requirements change
        TrainerHeaderV1 v1Header;
        //TrainerHeaderV2 v2Header;
    };

} TrainerHeader;

static_assert(sizeof(TrainerHeader) < 4096/*PAAGE_SIZE*/);


code:
// This is an open source non-commercial project. Dear PVS-Studio, please check it.
// PVS-Studio Static Code Analyzer for C, C++, C#, and Java: http://www.viva64.com

extern "C"
{
    #include <Utils/_Syscall.hpp>
};

#include "Dynlib.hpp"

using namespace Mira::Utils;

int64_t Dynlib::LoadPrx(const char* p_PrxPath, int* p_OutModuleId)
{
    return (int64_t)syscall4(594, reinterpret_cast<void*>(const_cast<char*>(p_PrxPath)), 0, p_OutModuleId, 0);
}

int64_t Dynlib::UnloadPrx(int64_t p_PrxId)
{
    return (int64_t)syscall1(595, (void*)p_PrxId);
}

int64_t Dynlib::Dlsym(int64_t p_PrxId, const char* p_FunctionName, void* p_DestinationFunctionOffset)
{
    return (int64_t)syscall3(591, (void*)p_PrxId, (void*)p_FunctionName, p_DestinationFunctionOffset);
}


code:
#pragma once
#include <Utils/Types.hpp>

namespace Mira
{
    namespace Utils
    {
        class Dynlib
        {
        public:
            static int64_t LoadPrx(const char* p_PrxPath, int* p_OutModuleId);
            static int64_t UnloadPrx(int64_t p_PrxId);
            static int64_t Dlsym(int64_t p_PrxId, const char* p_FunctionName, void *p_DestinationFunctionOffset);
        };
    }
}


code:
// This is an open source non-commercial project. Dear PVS-Studio, please check it.
// PVS-Studio Static Code Analyzer for C, C++, C#, and Java: http://www.viva64.com

#include "Hook.hpp"
#include <Utils/Kdlsym.hpp>
#include <Utils/Kernel.hpp>
#include <Utils/Logger.hpp>

extern "C"
{
    #include <sys/mman.h>
    #include <hde64/hde64.h>
};

using namespace Mira::Utils;

#define HOOK_LENGTH	14

Hook::Hook() :
    m_TargetAddress(nullptr),
    m_HookAddress(nullptr),
    m_TrampolineAddress(nullptr),
    m_TrampolineSize(0),
    m_BackupData(nullptr),
    m_BackupLength(0),
    m_Enabled(false)
{

}

Hook::Hook(void* p_TargetAddress, void* p_HookAddress) :
    m_TargetAddress(p_TargetAddress),
    m_HookAddress(p_HookAddress),
    m_BackupData(nullptr),
    m_BackupLength(0),
    m_Enabled(false)
{
    if (p_TargetAddress == nullptr || p_HookAddress == nullptr)
        return;

    int32_t s_BackupDataLength = GetMinimumHookSize(p_TargetAddress);
    if (s_BackupDataLength < 0)
    {
        WriteLog(LL_Error, "could not backup hook for (%p).", p_TargetAddress);
        return;
    }

    uint8_t* s_BackupData = new uint8_t[s_BackupDataLength];
    if (s_BackupData == nullptr)
    {
        WriteLog(LL_Error, "could not allocate space for backup data.");
        return;
    }
    // Zero out and copy the beginning of the function
    memset(s_BackupData, 0, s_BackupDataLength);
	memcpy(s_BackupData, p_TargetAddress, s_BackupDataLength);

    // Assign our variables for tracking later
    m_BackupData = s_BackupData;
    m_BackupLength = s_BackupDataLength;

    m_TrampolineAddress = CreateTrampoline(&m_TrampolineSize);
}

Hook::~Hook()
{
    // Disable hooks on destruction
    if (m_Enabled)
        Disable();

    // We don't want to keep references to any previous code sections
    m_TargetAddress = nullptr;
    m_HookAddress = nullptr;

    // Free the backup data that was created
    if (m_BackupData != nullptr && m_BackupLength != 0)
        delete [] m_BackupData;

    m_BackupData = nullptr;
    m_BackupLength = 0;

    if (m_TrampolineAddress != nullptr)
        k_free(m_TrampolineAddress);

    m_TrampolineAddress = nullptr;
    m_TrampolineSize = 0;

    m_Enabled = false;
}

bool Hook::Enable()
{
    // Return false if the hook is already enabled
    if (m_Enabled)
        return false;

    // TODO: Enable the hook
    if (m_HookAddress == nullptr || m_TargetAddress == nullptr)
        return false;

    auto critical_enter = (void(*)(void))kdlsym(critical_enter);
	auto critical_exit = (void(*)(void))kdlsym(critical_exit);

	uint8_t jumpBuffer[] = {
		0xFF, 0x25, 0x00, 0x00, 0x00, 0x00,				// # jmp    QWORD PTR [rip+0x0]
		0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,	// # DQ: AbsoluteAddress
	}; // Shit takes 14 bytes

	uint64_t* jumpBufferAddress = (uint64_t*)(jumpBuffer + 6);

	// Assign the address
	*jumpBufferAddress = (uint64_t)m_HookAddress;

	// Change permissions and apply the hook
	critical_enter();
	cpu_disable_wp();
	memcpy(m_TargetAddress, jumpBuffer, sizeof(jumpBuffer));
	cpu_enable_wp();
	critical_exit();

    // Set the enabled flag
    m_Enabled = true;

    // Return successfully
    return true;
}

bool Hook::Disable()
{
    // Don't allow disabling of already disabled hooks
    if (!m_Enabled)
        return false;

    if (m_HookAddress == nullptr || m_TargetAddress == nullptr)
		return false;

	if (m_BackupData == nullptr || m_BackupLength == 0)
		return false;

    auto critical_enter = (void(*)(void))kdlsym(critical_enter);
	auto critical_exit = (void(*)(void))kdlsym(critical_exit);

	// Change permissions and apply the hook
	critical_enter();
	cpu_disable_wp();
	memcpy(m_TargetAddress, m_BackupData, m_BackupLength);
	cpu_enable_wp();
	critical_exit();

    // Set the disabled flag
    m_Enabled = false;

    // Return successfully
    return true;
}

void* Hook::GetOriginalFunctionAddress()
{
    return m_TargetAddress;
}

void* Hook::GetHookedFunctionAddress()
{
    return m_HookAddress;
}

void* Hook::GetTrampolineFunctionAddress(uint32_t* p_OutSize)
{
    if (p_OutSize != nullptr)
        *p_OutSize = m_TrampolineSize;

    return m_TrampolineAddress;
}

/*
    This function will calculate the minimum safe size to overwrite
    This will not chop opcodes in half (ex, len 15 opcode overwriting only 2/15 bytes)
    This is the amount that will be backed up
*/
int32_t Hook::GetMinimumHookSize(void* p_Target)
{
    hde64s hs;

	uint32_t hookSize = HOOK_LENGTH;
	uint32_t totalLength = 0;

	while (totalLength < hookSize)
	{
		uint32_t length = hde64_disasm(p_Target, &hs);
		if (hs.flags & F_ERROR)
			return -1;

		totalLength += length;
	}

	return totalLength;
}

uint8_t* Hook::CreateTrampoline(uint32_t* p_OutTrampolineSize)
{
    if (m_TargetAddress == nullptr || m_HookAddress == nullptr)
        return nullptr;

    if (m_BackupLength <= 0 || m_BackupData == nullptr)
        return nullptr;

    auto s_TrampolineSize = m_BackupLength + HOOK_LENGTH + sizeof(uint8_t); // NOP;
    auto s_Trampoline = static_cast<uint8_t*>(k_malloc(s_TrampolineSize));//new uint8_t[s_TrampolineSize];
    if (s_Trampoline == nullptr)
        return nullptr;

    WriteLog(LL_Debug, "trampoline: %p (%x)", s_Trampoline, s_TrampolineSize);
    WriteLog(LL_Debug, "backup (%p) backupLen (%x)", m_BackupData, m_BackupLength);

    // TODO: Set correct prot on this, unless we always expect rwx (bad assumption)
    memcpy(s_Trampoline, m_BackupData, m_BackupLength);

    // Set up the jmp hook (bless, no registers clobbered bitches)
    uint8_t jumpBuffer[] = {
		0xFF, 0x25, 0x00, 0x00, 0x00, 0x00,				// # jmp    QWORD PTR [rip+0x0]
		0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41,	// # DQ: AbsoluteAddress
	}; // Shit takes 14 bytes

	uint64_t* jumpBufferAddress = (uint64_t*)(jumpBuffer + 6);

    // Calculate and set the midfunction address
    uint64_t s_Midfunctionoffset = m_BackupLength - 1;
    WriteLog(LL_Debug, "midfunctionOffset: %x, backupLength %x", s_Midfunctionoffset, m_BackupLength);
    uint64_t s_TargetMidFunctionAddress = ((uint64_t)m_TargetAddress) + s_Midfunctionoffset;

    WriteLog(LL_Debug, "jumpBuffer (%p) jumpBufferAddress (%p) midFunctionAddress (%p)", jumpBuffer, jumpBufferAddress, s_TargetMidFunctionAddress);

    *jumpBufferAddress = s_TargetMidFunctionAddress;

    // Copy the jump buffer to the end of the backup bytes in the trampoline
    auto s_TrampolineJumpBufferAddress = (s_Trampoline + s_Midfunctionoffset);
    WriteLog(LL_Debug, "trampolineJump (%p) byteAtLoc %x", s_TrampolineJumpBufferAddress, *s_TrampolineJumpBufferAddress);

    memcpy(s_TrampolineJumpBufferAddress, jumpBuffer, sizeof(jumpBuffer));

    // Set the very last byte of the trampoline to NOP
    auto s_EndOfTrampoline = &s_Trampoline[s_TrampolineSize - 1];
    *s_EndOfTrampoline = 0x90;

    // Update the output size if there was one passed in
    if (p_OutTrampolineSize != nullptr)
        *p_OutTrampolineSize = s_TrampolineSize;

    return s_Trampoline;
}

void* Hook::k_malloc(size_t size)
{
	if (!size)
		size = sizeof(uint64_t);

	auto kmem_alloc = (vm_offset_t(*)(vm_map_t map, vm_size_t size))kdlsym(kmem_alloc);
	vm_map_t map = (vm_map_t)(*(uint64_t *)(kdlsym(kernel_map)));

	uint8_t* data = (uint8_t*)kmem_alloc(map, size);
	if (!data)
		return NULL;

	// Set our pointer header
	(*(uint64_t*)data) = size;

	// Return the start of the requested data
	return data + sizeof(uint64_t);
}

void Hook::k_free(void* address)
{
	if (!address)
		return;

	vm_map_t map = (vm_map_t)(*(uint64_t *)(kdlsym(kernel_map)));
	auto kmem_free = (void(*)(void* map, void* addr, size_t size))kdlsym(kmem_free);

	uint8_t* data = ((uint8_t*)address) - sizeof(uint64_t);

	uint64_t size = *(uint64_t*)data;

	kmem_free(map, data, size);
}


code:
#pragma once
#include <Utils/Types.hpp>

namespace Mira
{
    namespace Utils
    {
        class Hook
        {
        private:
            // Address of the target function
            void* m_TargetAddress;

            // Address of the hook
            void* m_HookAddress;

            // Address of our trampoline, this calls the preable of the original function, then jumps mid-function to the destination
            // This way, we can "call original" without needing to keep flip-flopping the hook on/off
            void* m_TrampolineAddress;
            uint32_t m_TrampolineSize;

            // The backup data length for the jmp overwrite
            uint8_t* m_BackupData;
            uint32_t m_BackupLength;

            bool m_Enabled;

        public:
            Hook(void* p_TargetAddress, void* p_HookAddress);
            Hook();

            ~Hook();

            bool Enable();
            bool Disable();

            void* GetOriginalFunctionAddress();
            void* GetHookedFunctionAddress();
            void* GetTrampolineFunctionAddress(uint32_t* p_OutSize);

            static int32_t GetMinimumHookSize(void* p_Target);

            bool IsEnabled() { return m_Enabled; }

        private:
            uint8_t* CreateTrampoline(uint32_t* p_OutTrampolineSize);

            void* k_malloc(size_t p_Size);
            void k_free(void* p_Address);
        };
    }
}


code:
#pragma once

struct proc;

namespace Mira
{
    namespace Utils
    {
        class IModule
        {
        public:
            IModule() { }
            virtual ~IModule() { }

            virtual bool OnLoad() { return true; }
            virtual bool OnUnload() { return true; }
            virtual bool OnSuspend() { return true; }
            virtual bool OnResume() { return true; }

            virtual bool OnProcessExec(struct proc* p_Process) { return true; }
            virtual bool OnProcessExecEnd(struct proc* p_Process) { return true; }

            virtual bool OnProcessExit(struct proc* p_Process) { return true; }

            virtual const char* GetName() { return ""; };
            virtual const char* GetDescription() { return ""; };
        };
    }
}


code:
#pragma once
#include <Utils/Types.hpp>
#include <Boot/Config.hpp>

#ifdef __cplusplus
extern "C" {
#endif

#ifndef MIRA_PLATFORM
#error MIRA_PLATFORM not set
#endif

#if MIRA_PLATFORM==ONI_UNKNOWN_PLATFORM
#include "Kdlsym/Default.hpp"
#elif MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_176
#include "Kdlsym/Orbis176.hpp"
#elif MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_405
#include "Kdlsym/Orbis405.hpp"
#elif MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_455
#include "Kdlsym/Orbis455.hpp"
#elif MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_474
#include "Kdlsym/Orbis474.hpp"
#elif MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_501
#include "Kdlsym/Orbis501.hpp"
#elif MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_503
#include "Kdlsym/Orbis503.hpp"
#elif MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_505
#include "Kdlsym/Orbis505.hpp"
#elif MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_555
#include "Kdlsym/Orbis555.hpp"
#elif MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_620
#include "Kdlsym/Orbis620.hpp"
#elif MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_650
#include "Kdlsym/Orbis650.hpp"
#elif MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_672
#include "Kdlsym/Orbis672.hpp"
#elif MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_900
#include "Kdlsym/Orbis900.hpp"
#endif

// Kernel base address, this must be filled out on-startup (normally done in oni_initializeKernel)
extern uint8_t* gKernelBase;

// Define kdlsym macro
#ifndef kdlsym
#define kdlsym(x) ((void*)((uint8_t *)&gKernelBase[kdlsym_addr_ ## x]))
#endif

#ifdef __cplusplus
}
#endif


code:
#pragma once
#include <Boot/Config.hpp>
#if MIRA_PLATFORM==ONI_UNKNOWN_PLATFORM

/*
These are the required functions in order for the Oni Framework to operate properly
These are all offsets into the base of the kernel. They expect all standard FreeBSD 9 prototypes

The reason we do not hardcode offsets here, is due to the different platforms that are supported, and
for the platforms that do enable kernel ASLR (Address Space Layout Randomization?)
*/

#define kdlsym_addr__mtx_lock_flags                        0xDEADCODE
#define kdlsym_addr__mtx_lock_sleep                        0xDEADCODE
#define kdlsym_addr__mtx_lock_spin_flags                   0xDEADCODE
#define kdlsym_addr__mtx_unlock_flags                      0xDEADCODE
#define kdlsym_addr__mtx_unlock_sleep                      0xDEADCODE
#define kdlsym_addr__mtx_unlock_spin_flags                 0xDEADCODE
#define kdlsym_addr__sceSblAuthMgrGetSelfInfo              0xDEADCODE
#define kdlsym_addr__sceSblAuthMgrSmStart                  0xDEADCODE
#define kdlsym_addr__sx_init_flags                         0xDEADCODE
#define kdlsym_addr__sx_slock                              0xDEADCODE
#define kdlsym_addr__sx_sunlock                            0xDEADCODE
#define kdlsym_addr__sx_xlock                              0xDEADCODE
#define kdlsym_addr__sx_xunlock                            0xDEADCODE
#define kdlsym_addr__thread_lock_flags                     0xDEADCODE
#define kdlsym_addr__vm_map_lock_read                      0xDEADCODE
#define kdlsym_addr__vm_map_unlock_read                    0xDEADCODE
#define kdlsym_addr_AesCbcCfb128Decrypt                    0xDEADCODE
#define kdlsym_addr_AesCbcCfb128Encrypt                    0xDEADCODE
#define kdlsym_addr_allproc                                0xDEADCODE
#define kdlsym_addr_allproc_lock                           0xDEADCODE
#define kdlsym_addr_avcontrol_sleep                        0xDEADCODE
#define kdlsym_addr_contigfree                             0xDEADCODE
#define kdlsym_addr_contigmalloc                           0xDEADCODE
#define kdlsym_addr_copyin                                 0xDEADCODE
#define kdlsym_addr_copyinstr                              0xDEADCODE
#define kdlsym_addr_copyout                                0xDEADCODE
#define kdlsym_addr_critical_enter                         0xDEADCODE
#define kdlsym_addr_critical_exit                          0xDEADCODE
#define kdlsym_addr_destroy_dev                            0xDEADCODE
#define kdlsym_addr_dmem_start_app_process                 0xDEADCODE
#define kdlsym_addr_dynlib_do_dlsym                        0xDEADCODE
#define kdlsym_addr_dynlib_find_obj_by_handle              0xDEADCODE
#define kdlsym_addr_eventhandler_deregister                0xDEADCODE
#define kdlsym_addr_eventhandler_find_list                 0xDEADCODE
#define kdlsym_addr_eventhandler_register                  0xDEADCODE
#define kdlsym_addr_exec_new_vmspace                       0xDEADCODE
#define kdlsym_addr_faultin                                0xDEADCODE
#define kdlsym_addr_fget_unlocked                          0xDEADCODE
#define kdlsym_addr_fpu_kern_ctx                           0xDEADCODE
#define kdlsym_addr_fpu_kern_enter                         0xDEADCODE
#define kdlsym_addr_fpu_kern_leave                         0xDEADCODE
#define kdlsym_addr_free                                   0xDEADCODE
#define kdlsym_addr_gdt                                    0xDEADCODE
#define kdlsym_addr_gpu_va_page_list                       0xDEADCODE
#define kdlsym_addr_icc_nvs_read                           0xDEADCODE
#define kdlsym_addr_kern_close                             0xDEADCODE
#define kdlsym_addr_kern_ioctl                             0xDEADCODE
#define kdlsym_addr_kern_mkdirat                           0xDEADCODE
#define kdlsym_addr_kern_open                              0xDEADCODE
#define kdlsym_addr_kern_openat                            0xDEADCODE
#define kdlsym_addr_kern_readv                             0xDEADCODE
#define kdlsym_addr_kern_reboot                            0xDEADCODE
#define kdlsym_addr_kern_sysents                           0xDEADCODE
#define kdlsym_addr_kern_thr_create                        0xDEADCODE
#define kdlsym_addr_kernel_map                             0xDEADCODE
#define kdlsym_addr_kernel_mount                           0xDEADCODE
#define kdlsym_addr_killproc                               0xDEADCODE
#define kdlsym_addr_kmem_alloc                             0xDEADCODE
#define kdlsym_addr_kmem_free                              0xDEADCODE
#define kdlsym_addr_kproc_create                           0xDEADCODE
#define kdlsym_addr_kproc_exit                             0xDEADCODE
#define kdlsym_addr_kthread_add                            0xDEADCODE
#define kdlsym_addr_kthread_exit                           0xDEADCODE
#define kdlsym_addr_M_LINKER                               0xDEADCODE
#define kdlsym_addr_M_MOUNT                                0xDEADCODE
#define kdlsym_addr_M_TEMP                                 0xDEADCODE
#define kdlsym_addr_make_dev_p                             0xDEADCODE
#define kdlsym_addr_malloc                                 0xDEADCODE
#define kdlsym_addr_memcmp                                 0xDEADCODE
#define kdlsym_addr_memcpy                                 0xDEADCODE
#define kdlsym_addr_memmove                                0xDEADCODE
#define kdlsym_addr_memset                                 0xDEADCODE
#define kdlsym_addr_mini_syscore_self_binary               0xDEADCODE
#define kdlsym_addr_mount_arg                              0xDEADCODE
#define kdlsym_addr_mount_argb                             0xDEADCODE
#define kdlsym_addr_mount_argf                             0xDEADCODE
#define kdlsym_addr_mtx_destroy                            0xDEADCODE
#define kdlsym_addr_mtx_init                               0xDEADCODE
#define kdlsym_addr_mtx_lock_sleep                         0xDEADCODE
#define kdlsym_addr_mtx_unlock_sleep                       0xDEADCODE
#define kdlsym_addr_name_to_nids                           0xDEADCODE
#define kdlsym_addr_pause                                  0xDEADCODE
#define kdlsym_addr_pfind                                  0xDEADCODE
#define kdlsym_addr_pmap_activate                          0xDEADCODE
#define kdlsym_addr_printf                                 0xDEADCODE
#define kdlsym_addr_prison0                                0xDEADCODE
#define kdlsym_addr_proc0                                  0xDEADCODE
#define kdlsym_addr_proc_reparent                          0xDEADCODE
#define kdlsym_addr_proc_rwmem                             0xDEADCODE
#define kdlsym_addr_realloc                                0xDEADCODE
#define kdlsym_addr_rootvnode                              0xDEADCODE
#define kdlsym_addr_RsaesPkcs1v15Dec2048CRT                0xDEADCODE
#define kdlsym_addr_sbl_eap_internal_partition_key         0xDEADCODE
#define kdlsym_addr_sbl_keymgr_buf_gva                     0xDEADCODE
#define kdlsym_addr_sbl_keymgr_buf_va                      0xDEADCODE
#define kdlsym_addr_sbl_keymgr_key_rbtree                  0xDEADCODE
#define kdlsym_addr_sbl_keymgr_key_slots                   0xDEADCODE
#define kdlsym_addr_sbl_pfs_sx                             0xDEADCODE
#define kdlsym_addr_sceSblACMgrGetPathId                   0xDEADCODE
#define kdlsym_addr_sceSblAuthMgrIsLoadable2               0xDEADCODE
#define kdlsym_addr_sceSblAuthMgrSmVerifyHeader            0xDEADCODE
#define kdlsym_addr_sceSblAuthMgrVerifyHeader              0xDEADCODE
#define kdlsym_addr_sceSblDriverSendMsg                    0xDEADCODE
#define kdlsym_addr_sceSblGetEAPInternalPartitionKey       0xDEADCODE
#define kdlsym_addr_sceSblKeymgrClearKey                   0xDEADCODE
#define kdlsym_addr_sceSblKeymgrSetKeyForPfs               0xDEADCODE
#define kdlsym_addr_sceSblKeymgrSetKeyStorage              0xDEADCODE
#define kdlsym_addr_sceSblKeymgrSmCallfunc                 0xDEADCODE
#define kdlsym_addr_sceSblPfsSetKeys                       0xDEADCODE
#define kdlsym_addr_sceSblRngGetRandomNumber               0xDEADCODE
#define kdlsym_addr_sceSblServiceMailbox                   0xDEADCODE
#define kdlsym_addr_self_orbis_sysvec                      0xDEADCODE
#define kdlsym_addr_Sha256Hmac                             0xDEADCODE
#define kdlsym_addr_snprintf                               0xDEADCODE
#define kdlsym_addr_spinlock_exit                          0xDEADCODE
#define kdlsym_addr_sprintf                                0xDEADCODE
#define kdlsym_addr_sscanf                                 0xDEADCODE
#define kdlsym_addr_strcmp                                 0xDEADCODE
#define kdlsym_addr_strdup                                 0xDEADCODE
#define kdlsym_addr_strlen                                 0xDEADCODE
#define kdlsym_addr_strncmp                                0xDEADCODE
#define kdlsym_addr_strstr                                 0xDEADCODE
#define kdlsym_addr_sys_accept                             0xDEADCODE
#define kdlsym_addr_sys_bind                               0xDEADCODE
#define kdlsym_addr_sys_close                              0xDEADCODE
#define kdlsym_addr_sys_dup2                               0xDEADCODE
#define kdlsym_addr_sys_fstat                              0xDEADCODE
#define kdlsym_addr_sys_getdents                           0xDEADCODE
#define kdlsym_addr_sys_kill                               0xDEADCODE
#define kdlsym_addr_sys_listen                             0xDEADCODE
#define kdlsym_addr_sys_lseek                              0xDEADCODE
#define kdlsym_addr_sys_mkdir                              0xDEADCODE
#define kdlsym_addr_sys_mlock                              0xDEADCODE
#define kdlsym_addr_sys_mlockall                           0xDEADCODE
#define kdlsym_addr_sys_mmap                               0xDEADCODE
#define kdlsym_addr_sys_munmap                             0xDEADCODE
#define kdlsym_addr_sys_nmount                             0xDEADCODE
#define kdlsym_addr_sys_open                               0xDEADCODE
#define kdlsym_addr_sys_ptrace                             0xDEADCODE
#define kdlsym_addr_sys_read                               0xDEADCODE
#define kdlsym_addr_sys_recvfrom                           0xDEADCODE
#define kdlsym_addr_sys_rmdir                              0xDEADCODE
#define kdlsym_addr_sys_sendto                             0xDEADCODE
#define kdlsym_addr_sys_setuid                             0xDEADCODE
#define kdlsym_addr_sys_shutdown                           0xDEADCODE
#define kdlsym_addr_sys_socket                             0xDEADCODE
#define kdlsym_addr_sys_stat                               0xDEADCODE
#define kdlsym_addr_sys_unlink                             0xDEADCODE
#define kdlsym_addr_sys_unmount                            0xDEADCODE
#define kdlsym_addr_sys_wait4                              0xDEADCODE
#define kdlsym_addr_sys_write                              0xDEADCODE
#define kdlsym_addr_trap_fatal                             0xDEADCODE
#define kdlsym_addr_utilUSleep                             0xDEADCODE
#define kdlsym_addr_vm_fault_disable_pagefaults            0xDEADCODE
#define kdlsym_addr_vm_fault_enable_pagefaults             0xDEADCODE
#define kdlsym_addr_vm_map_lookup_entry                    0xDEADCODE
#define kdlsym_addr_vmspace_acquire_ref                    0xDEADCODE
#define kdlsym_addr_vmspace_alloc                          0xDEADCODE
#define kdlsym_addr_vmspace_free                           0xDEADCODE
#define kdlsym_addr_vn_fullpath                            0xDEADCODE
#define kdlsym_addr_vsnprintf                              0xDEADCODE
#define kdlsym_addr_wakeup                                 0xDEADCODE
#define kdlsym_addr_Xfast_syscall                          0xDEADCODE

// FakeSelf hooks
#define kdlsym_addr_sceSblAuthMgrIsLoadable__sceSblACMgrGetPathId_hook        0xDEADCODE
#define kdlsym_addr_sceSblAuthMgrIsLoadable2_hook                             0xDEADCODE
#define kdlsym_addr_sceSblAuthMgrSmLoadSelfSegment__sceSblServiceMailbox_hook 0xDEADCODE
#define kdlsym_addr_sceSblAuthMgrSmLoadSelfBlock__sceSblServiceMailbox_hook   0xDEADCODE
#define kdlsym_addr_sceSblAuthMgrVerifyHeader_hookA                           0xDEADCODE
#define kdlsym_addr_sceSblAuthMgrVerifyHeader_hookB                           0xDEADCODE

// FakePkg hooks
#define kdlsym_addr_sceSblKeymgrSetKeyStorage__sceSblDriverSendMsg_hook       0xDEADCODE
#define kdlsym_addr_sceSblKeymgrInvalidateKey__sx_xlock_hook                  0xDEADCODE
#define kdlsym_addr_npdrm_decrypt_isolated_rif__sceSblKeymgrSmCallfunc_hook   0xDEADCODE
#define kdlsym_addr_npdrm_decrypt_rif_new__sceSblKeymgrSmCallfunc_hook        0xDEADCODE
#define kdlsym_addr_mountpfs__sceSblPfsSetKeys_hookA                          0xDEADCODE
#define kdlsym_addr_mountpfs__sceSblPfsSetKeys_hookB                          0xDEADCODE

// SceShellCore patches - call sceKernelIsGenuineCEX
#define ssc_sceKernelIsGenuineCEX_patchA                   0xDEADCODE
#define ssc_sceKernelIsGenuineCEX_patchB                   0xDEADCODE
#define ssc_sceKernelIsGenuineCEX_patchC                   0xDEADCODE
#define ssc_sceKernelIsGenuineCEX_patchD                   0xDEADCODE

// SceShellCore patches - call nidf_libSceDipsw
#define ssc_nidf_libSceDipsw_patchA                        0xDEADCODE
#define ssc_nidf_libSceDipsw_patchB                        0xDEADCODE
#define ssc_nidf_libSceDipsw_patchC                        0xDEADCODE
#define ssc_nidf_libSceDipsw_patchD                        0xDEADCODE

#define ssc_enable_fakepkg_patch                           0xDEADCODE

// SceShellCore patches - use free prefix instead fake
#define ssc_fake_to_free_patch                             0xDEADCODE

// SceShellUI patches - debug patches
#define ssu_sceSblRcMgrIsAllowDebugMenuForSettings_patch   0xDEADCODE
#define ssu_sceSblRcMgrIsStoreMode_patch                   0xDEADCODE

#endif


code:
#pragma once
#include <Boot/Config.hpp>
#if MIRA_PLATFORM==MIRA_PLATFORM_ORBIS_BSD_176

/*
These are the required functions in order for the Oni Framework to operate properly
These are all offsets into the base of the kernel. They expect all standard FreeBSD 9 prototypes

The reason we do not hardcode offsets here, is due to the different platforms that are supported, and
for the platforms that do enable kernel ASLR (Address Space Layout Randomization?)
*/

#define kdlsym_addr__mtx_lock_flags                        0x00225D20
#define kdlsym_addr__mtx_lock_sleep                        0x00225D80
#define kdlsym_addr__mtx_unlock_flags                      0x00225F70
#define kdlsym_addr__mtx_unlock_sleep                      0x00225FF0
#define kdlsym_addr__sceSblAuthMgrCheckSelfIsLoadable      0x005C7AC0 // !!! not 100% sure that is correct !!!5.00 sceSblAuthMgrIsLoadable2 0x63C110
#define kdlsym_addr__sceSblAuthMgrGetSelfInfo              0x005C8520
#define kdlsym_addr__sceSblAuthMgrVerifySelfHeader         0x005C7B70 // 5.00 sceSblAuthMgrVerifyHeader (actually 5.00 correct name also seems to be _sceSblAuthMgrVerifySelfHeader)
#define kdlsym_addr__sx_slock                              0x0023E320
#define kdlsym_addr__sx_sunlock                            0x0023E490
#define kdlsym_addr__sx_xlock                              0x0023E3D0
#define kdlsym_addr__sx_xunlock                            0x0023E500
#define kdlsym_addr__vm_map_lock_read                      0x003ACA70
#define kdlsym_addr__vm_map_unlock_read                    0x003ACAA0
#define kdlsym_addr_AesCbcCfb128Decrypt                    0x004593F0
#define kdlsym_addr_AesCbcCfb128Encrypt                    0x00459250
#define kdlsym_addr_allproc                                0x010CC350
#define kdlsym_addr_allproc_lock                           0x010CC2F0
#define kdlsym_addr_contigfree                             0x003A65B0
#define kdlsym_addr_contigmalloc                           0x003A6280
#define kdlsym_addr_copyin                                 0x00413CC0
#define kdlsym_addr_copyinstr                              0x00414010
#define kdlsym_addr_critical_enter                         0x0023DC30
#define kdlsym_addr_critical_exit                          0x0023DC40
#define kdlsym_addr_dmem_start_app_process                 0x0
#define kdlsym_addr_eventhandler_register                  0x00267250
#define kdlsym_addr_exec_new_vmspace                       0x00206A10
#define kdlsym_addr_faultin                                0x003AA000
#define kdlsym_addr_fget_unlocked                          0x001FB130
#define kdlsym_addr_fpu_kern_ctx                           0x013E2840
#define kdlsym_addr_fpu_kern_enter                         0x004009D0
#define kdlsym_addr_fpu_kern_leave                         0x00400AC0
#define kdlsym_addr_free                                   0x00222820
#define kdlsym_addr_gpu_va_page_list                       0x013E2210
#define kdlsym_addr_icc_nvs_read                           0x00439CD0
#define kdlsym_addr_kern_close                             0x001F8990
#define kdlsym_addr_kern_mkdirat                           0x002CEEE0
#define kdlsym_addr_kern_open                              0x002C9DB0
#define kdlsym_addr_kern_openat                            0x002C9E10
#define kdlsym_addr_kern_readv                             0x0027AD30
#define kdlsym_addr_kern_reboot                            0x002354B0
#define kdlsym_addr_kern_sysents                           0x0102DC70
#define kdlsym_addr_kern_thr_create                        0x00243F40
#define kdlsym_addr_kernel_map                             0x010F6D70
#define kdlsym_addr_kmem_alloc                             0x003AB260
#define kdlsym_addr_kmem_free                              0x003AB410
#define kdlsym_addr_kproc_create                           0x00217080
#define kdlsym_addr_kthread_add                            0x00217700
#define kdlsym_addr_kthread_exit                           0x002179A0
#define kdlsym_addr_M_LINKER                               0x01038FE0
#define kdlsym_addr_M_MOUNT                                0x01049B50
#define kdlsym_addr_M_TEMP                                 0x010396E0
#define kdlsym_addr_malloc                                 0x00222660
#define kdlsym_addr_memcmp                                 0x002D6570
#define kdlsym_addr_memcpy                                 0x00413BC0
#define kdlsym_addr_memmove                                0x0041EB10
#define kdlsym_addr_memset                                 0x0041EB30
#define kdlsym_addr_mini_syscore_self_binary               0x00D2CC98 // 1.76 (b2ca78 phys addr)
#define kdlsym_addr_mtx_destroy                            0x00226670
#define kdlsym_addr_mtx_init                               0x00226600
#define kdlsym_addr_mtx_lock_sleep                         0x00225D80 //  '_' doubled
#define kdlsym_addr_mtx_unlock_sleep                       0x00225FF0 //  ----||----
#define kdlsym_addr_pfind                                  0x00228B10
#define kdlsym_addr_pmap_activate                          0x00413390
#define kdlsym_addr_printf                                 0x0026E340
#define kdlsym_addr_prison0                                0x01037250
#define kdlsym_addr_proc0                                  0x010B2708
#define kdlsym_addr_proc_reparent                          0x00208C60
#define kdlsym_addr_proc_rwmem                             0x002805E0
#define kdlsym_addr_realloc                                0x00222930
#define kdlsym_addr_rootvnode                              0x010EF920
#define kdlsym_addr_RsaesPkcs1v15Dec2048CRT                0x00465030
#define kdlsym_addr_sbl_eap_internal_partition_key         0x014BC010
#define kdlsym_addr_sbl_pfs_sx                             0x0
#define kdlsym_addr_sceSblAuthMgrSmStart                   0x005C8970
#define kdlsym_addr_sceSblAuthMgrSmVerifyHeader            0x005C9750
#define kdlsym_addr_sceSblDriverSendMsg                    0x005AFCC0 // Require some work. No 'xor     edx, edx, with jmp' , only direct function available
#define kdlsym_addr_sceSblGetEAPInternalPartitionKey       0x005B1B00
#define kdlsym_addr_sceSblKeymgrClearKey                   0x005B3590
#define kdlsym_addr_sceSblKeymgrSetKey                     0x005B33B0 // 5.00 sceSblKeymgrSetKeyForPfs
#define kdlsym_addr_sceSblKeymgrSmCallfunc                 0x005B3CF0
#define kdlsym_addr_sceSblPfsSetKey                        0x005B2510 // 5.00 sceSblPfsSetKeys
#define kdlsym_addr_sceSblServiceMailbox                   0x005BF190
#define kdlsym_addr_sceSblACMgrGetPathId                   0x003F5230
#define kdlsym_addr_self_orbis_sysvec                      0x01063E38 // found by label
#define kdlsym_addr_Sha256Hmac                             0x0045EFC0
#define kdlsym_addr_snprintf                               0x0026E560
#define kdlsym_addr_sscanf                                 0x00271D60
#define kdlsym_addr_strcmp                                 0x002D7A20
#define kdlsym_addr_strdup                                 0x002D7B30
#define kdlsym_addr_strlen                                 0x002D7C80
#define kdlsym_addr_strncmp                                0x002D7CA0
#define kdlsym_addr_strstr                                 0x002D7E40
#define kdlsym_addr_trap_fatal                             0x00415A30
#define kdlsym_addr_utilUSleep                             0x005DBAF0
#define kdlsym_addr_vm_map_lookup_entry                    0x003AD090
#define kdlsym_addr_vmspace_acquire_ref                    0x003AC930
#define kdlsym_addr_vmspace_alloc                          0x003AC520
#define kdlsym_addr_vmspace_free                           0x003AC780
#define kdlsym_addr_vsnprintf                              0x0026E600
#define kdlsym_addr_Xfast_syscall                          0x003FF260
#define kdlsym_addr_wakeup                                 0x0023F5A0
#define kdlsym_addr_eventhandler_register                  0x00267250
#define kdlsym_addr_eventhandler_deregister                0x00267540
#define kdlsym_addr_eventhandler_find_list                 0x00267660
#define kdlsym_addr_vm_fault_disable_pagefaults            0x003A9320
#define kdlsym_addr_vm_fault_enable_pagefaults             0x003A9350
#define kdlsym_addr_gdt                                    0x01114E60
#define kdlsym_addr_make_dev_p                             0x001EE5F0
#define kdlsym_addr_destroy_dev                            0x001EEB80

// PS4GDB
#define kdlsym_addr_bzero                                  0xDEADC0DEDEADBEEF
#define kdlsym_addr_sys_getpid                             0xDEADC0DEDEADBEEF
#define kdlsym_addr_sys_sysctl                             0xDEADC0DEDEADBEEF

// FakeSelf hooks
#define kdlsym_addr_sceSblAuthMgrIsLoadable__sceSblACMgrGetPathId_hook        0x005C67BA
#define kdlsym_addr_sceSblAuthMgrIsLoadable2_hook                             0x0
#define kdlsym_addr_sceSblAuthMgrSmLoadSelfSegment__sceSblServiceMailbox_hook 0x0
#define kdlsym_addr_sceSblAuthMgrSmLoadSelfBlock__sceSblServiceMailbox_hook   0x0
#define kdlsym_addr_sceSblAuthMgrVerifyHeader_hookA                           0x0
#define kdlsym_addr_sceSblAuthMgrVerifyHeader_hookB                           0x0

// FakePkg hooks
#define kdlsym_addr_sceSblKeymgrSetKeyStorage__sceSblDriverSendMsg_hook       0x0
#define kdlsym_addr_sceSblKeymgrInvalidateKey__sx_xlock_hook                  0x0
#define kdlsym_addr_npdrm_decrypt_isolated_rif__sceSblKeymgrSmCallfunc_hook   0x0
#define kdlsym_addr_npdrm_decrypt_rif_new__sceSblKeymgrSmCallfunc_hook        0x0
#define kdlsym_addr_mountpfs__sceSblPfsSetKeys_hookA                          0x0
#define kdlsym_addr_mountpfs__sceSblPfsSetKeys_hookB                          0x0

// SceShellCore patches - call sceKernelIsGenuineCEX
#define ssc_sceKernelIsGenuineCEX_patchA                   0x0
#define ssc_sceKernelIsGenuineCEX_patchB                   0x0
#define ssc_sceKernelIsGenuineCEX_patchC                   0x0
#define ssc_sceKernelIsGenuineCEX_patchD                   0x0

// SceShellCore patches - call nidf_libSceDipsw
#define ssc_nidf_libSceDipsw_patchA                        0x0
#define ssc_nidf_libSceDipsw_patchB                        0x0
#define ssc_nidf_libSceDipsw_patchC                        0x0
#define ssc_nidf_libSceDipsw_patchD                        0x0

// SceShellCore patches - use free prefix instead fake
#define ssc_fake_to_free_patch                             0x0
#endif


code:
#pragma once
#include <Boot/Config.hpp>

// Offsets ported by SiSTRo & Joonie

#if MIRA_PLATFORM == MIRA_PLATFORM_ORBIS_BSD_405
/*
These are the required functions in order for the Oni Framework to operate properly
These are all offsets into the base of the kernel. They expect all standard FreeBSD 9 prototypes

The reason we do not hardcode offsets here, is due to the different platforms that are supported, and
for the platforms that do enable kernel ASLR (Address Space Layout Randomization?)
*/

#define kdlsym_addr__mtx_lock_flags                        0x0036E260
#define kdlsym_addr__mtx_lock_sleep                        0x0036E2D0
#define kdlsym_addr__mtx_lock_spin_flags                   0x0036E640
#define kdlsym_addr__mtx_unlock_flags                      0x0036E510
#define kdlsym_addr__mtx_unlock_sleep                      0x0036E5E0
#define kdlsym_addr__mtx_unlock_spin_flags                 0x0036E800
#define kdlsym_addr__sceSblAuthMgrGetSelfInfo              0x00615360
#define kdlsym_addr__sceSblAuthMgrSmStart                  0x006153F0
#define kdlsym_addr__sx_init_flags                         0x0027AAF0
#define kdlsym_addr__sx_slock                              0x0027AB70
#define kdlsym_addr__sx_sunlock                            0x0027ACF0
#define kdlsym_addr__sx_xlock                              0x0027AC20
#define kdlsym_addr__sx_xunlock                            0x0027ADB0
#define kdlsym_addr__thread_lock_flags                     0x0036E940
#define kdlsym_addr__vm_map_lock_read                      0x0043DF10
#define kdlsym_addr__vm_map_unlock_read                    0x0043DF60
#define kdlsym_addr_AesCbcCfb128Decrypt                    0x0019D880
#define kdlsym_addr_AesCbcCfb128Encrypt                    0x0019D650
#define kdlsym_addr_allproc                                0x01FE3498
#define kdlsym_addr_allproc_lock                           0x01FE3438
#define kdlsym_addr_avcontrol_sleep                        0x006AE670
#define kdlsym_addr_cloneuio                               0x0035F810
#define kdlsym_addr_console_cdev                           0x01A06FE0
#define kdlsym_addr_console_write                          0x0026EB20
#define kdlsym_addr_contigfree                             0x002761C0
#define kdlsym_addr_contigmalloc                           0x00275E60
#define kdlsym_addr_copyin                                 0x00286DF0
#define kdlsym_addr_copyinstr                              0x00287160
#define kdlsym_addr_copyout                                0x00286D70
#define kdlsym_addr_critical_enter                         0x001E2660
#define kdlsym_addr_critical_exit                          0x001E2670
#define kdlsym_addr_deci_tty_write                         0x00470EF0
#define kdlsym_addr_destroy_dev                            0x001F5BF0
//#define kdlsym_addr_dmem_start_app_process                 0x0
#define kdlsym_addr_dynlib_do_dlsym                        0x000E0770
#define kdlsym_addr_dynlib_find_obj_by_handle              0x000E1840
#define kdlsym_addr_eventhandler_deregister                0x00459520
#define kdlsym_addr_eventhandler_find_list                 0x00459710
#define kdlsym_addr_eventhandler_register                  0x004591B0
#define kdlsym_addr_exec_new_vmspace                       0x00214A00
#define kdlsym_addr_faultin                                0x002164A0
#define kdlsym_addr_fget_unlocked                          0x0045E8A0
#define kdlsym_addr_fpu_kern_ctx                           0x0235C6C0
#define kdlsym_addr_fpu_kern_enter                         0x0039A120
#define kdlsym_addr_fpu_kern_leave                         0x0039A220
#define kdlsym_addr_free                                   0x001D18D0
#define kdlsym_addr_gdt                                    0x01FF2040
#define kdlsym_addr_gpu_va_page_list                       0x0234ED68
#define kdlsym_addr_icc_nvs_read                           0x003C8490
#define kdlsym_addr_kern_close                             0x0045C440
#define kdlsym_addr_kern_ioctl                             0x00167610
#define kdlsym_addr_kern_mkdirat                           0x00029330
#define kdlsym_addr_kern_open                              0x00024400
#define kdlsym_addr_kern_openat                            0x00024460
#define kdlsym_addr_kern_readv                             0x00166900
#define kdlsym_addr_kern_reboot                            0x0025FC10
#define kdlsym_addr_kern_sysents                           0x00F17790
#define kdlsym_addr_kern_thr_create                        0x002ECCD0
#define kdlsym_addr_kernel_map                             0x001D3700
#define kdlsym_addr_kernel_mount                           0x00204170
#define kdlsym_addr_killproc                               0x0040E6B0
#define kdlsym_addr_kmem_alloc                             0x00369500
#define kdlsym_addr_kmem_free                              0x003696B0
#define kdlsym_addr_kproc_create                           0x001C92F0
#define kdlsym_addr_kproc_exit                             0x001C9590
#define kdlsym_addr_kthread_add                            0x001C9890
#define kdlsym_addr_kthread_exit                           0x001C9B60
#define kdlsym_addr_M_IOV                                  0x01340C90
#define kdlsym_addr_M_LINKER                               0x013468D0
#define kdlsym_addr_M_MOUNT                                0x01356480
#define kdlsym_addr_M_TEMP                                 0x0134B730
#define kdlsym_addr_make_dev_p                             0x001F56B0
#define kdlsym_addr_malloc                                 0x001D1700
#define kdlsym_addr_memcmp                                 0x0029CD10
#define kdlsym_addr_memcpy                                 0x00286CF0
#define kdlsym_addr_memmove                                0x00339440
#define kdlsym_addr_memset                                 0x001ECB10
#define kdlsym_addr_mini_syscore_self_binary               0x0136B3E8
#define kdlsym_addr_mount_arg                              0x00203EF0
#define kdlsym_addr_mount_argb                             0x00202540
#define kdlsym_addr_mount_argf                             0x00203FD0
#define kdlsym_addr_mtx_destroy                            0x0036ECE0
#define kdlsym_addr_mtx_init                               0x0036EC70
#define kdlsym_addr_mtx_lock_sleep                         0x0036E2D0
#define kdlsym_addr_mtx_unlock_sleep                       0x0036E5E0
#define kdlsym_addr_name_to_nids                           0x000E3430
#define kdlsym_addr_pause                                  0x0008A7A0
#define kdlsym_addr_pfind                                  0x002FA310
#define kdlsym_addr_pmap_activate                          0x003F7B40
#define kdlsym_addr_printf                                 0x00347580
#define kdlsym_addr_prison0                                0x00F26010
#define kdlsym_addr_proc0                                  0x019536A0
#define kdlsym_addr_proc_reparent                          0x00049A60
#define kdlsym_addr_proc_rwmem                             0x000ABBB0
#define kdlsym_addr_realloc                                0x001D1A00
#define kdlsym_addr_rootvnode                              0x0206D250
#define kdlsym_addr_RsaesPkcs1v15Dec2048CRT                0x001E82A0
#define kdlsym_addr_sbl_eap_internal_partition_key         0x023DC000
#define kdlsym_addr_sbl_keymgr_buf_gva                     0x02374200
#define kdlsym_addr_sbl_keymgr_buf_va                      0x02374000
#define kdlsym_addr_sbl_keymgr_key_rbtree                  0x02370058
#define kdlsym_addr_sbl_keymgr_key_slots                   0x02370048
#define kdlsym_addr_sbl_pfs_sx                             0x0
#define kdlsym_addr_sbl_drv_msg_mtx                        0x0234ED70
#define kdlsym_addr_sceSblACMgrGetPathId                   0x00360620
#define kdlsym_addr_sceSblAuthMgrIsLoadable2               0x00614A80
#define kdlsym_addr_sceSblAuthMgrSmVerifyHeader            0x006163C0
#define kdlsym_addr_sceSblAuthMgrVerifyHeader              0x00614AE0
#define kdlsym_addr_sceSblDriverSendMsg                    0x005F6400
#define kdlsym_addr_sceSblGetEAPInternalPartitionKey       0x00605330
#define kdlsym_addr_sceSblKeymgrClearKey                   0x005FEE10
#define kdlsym_addr_sceSblKeymgrSetKeyForPfs               0x005FEC40
#define kdlsym_addr_sceSblKeymgrSetKeyStorage              0x0
#define kdlsym_addr_sceSblKeymgrSmCallfunc                 0x005FF500
#define kdlsym_addr_sceSblPfsSetKeys                       0x00600640
#define kdlsym_addr_sceSblRngGetRandomNumber               0x0061B690
#define kdlsym_addr_sceSblServiceMailbox                   0x00606F40
#define kdlsym_addr_self_orbis_sysvec                      0x01862F08
#define kdlsym_addr_Sha256Hmac                             0x003369B0
#define kdlsym_addr_snprintf                               0x00347860
#define kdlsym_addr_spinlock_exit                          0x0038AC40
#define kdlsym_addr_sprintf                                0x00347790
#define kdlsym_addr_sscanf                                 0x003813B0
#define kdlsym_addr_strcmp                                 0x00274970
#define kdlsym_addr_strdup                                 0x00021640
#define kdlsym_addr_strlen                                 0x001D3640
#define kdlsym_addr_strncmp                                0x00251250
#define kdlsym_addr_strstr                                 0x0032DAB0
#define kdlsym_addr_sys_accept                             0x00122620
#define kdlsym_addr_sys_bind                               0x00121C80
#define kdlsym_addr_sys_close                              0x0045C430
#define kdlsym_addr_sys_dup2                               0x0045A670
#define kdlsym_addr_sys_fstat                              0x0045C9C0
#define kdlsym_addr_sys_getdents                           0x00029AD0
#define kdlsym_addr_sys_kill                               0x0040C0E0
#define kdlsym_addr_sys_listen                             0x00121E90
#define kdlsym_addr_sys_lseek                              0x00026280
#define kdlsym_addr_sys_mkdir                              0x000292B0
#define kdlsym_addr_sys_mlock                              0x0031DC60
#define kdlsym_addr_sys_mlockall                           0x0031DD10
#define kdlsym_addr_sys_mmap                               0x0031CCF0
#define kdlsym_addr_sys_munmap                             0x0031D460
#define kdlsym_addr_sys_nmount                             0x00200C80
#define kdlsym_addr_sys_open                               0x000243E0
#define kdlsym_addr_sys_ptrace                             0x000AC020
#define kdlsym_addr_sys_read                               0x00166820
#define kdlsym_addr_sys_recvfrom                           0x00123810
#define kdlsym_addr_sys_rmdir                              0x00029630
#define kdlsym_addr_sys_sendto                             0x00123150
#define kdlsym_addr_sys_setuid                             0x00085B20
#define kdlsym_addr_sys_shutdown                           0x001239E0
#define kdlsym_addr_sys_socket                             0x00121340
#define kdlsym_addr_sys_stat                               0x00026880
#define kdlsym_addr_sys_unlink                             0x00025C90
#define kdlsym_addr_sys_unmount                            0x00202560
#define kdlsym_addr_sys_wait4                              0x00049BA0
#define kdlsym_addr_sys_write                              0x00166D70
#define kdlsym_addr_trap_fatal                             0x000EC770
#define kdlsym_addr_utilUSleep                             0x0062A3E0
#define kdlsym_addr_vm_fault_disable_pagefaults            0x000C8FB0
#define kdlsym_addr_vm_fault_enable_pagefaults             0x000C8FE0
#define kdlsym_addr_vm_map_lookup_entry                    0x0043E470
#define kdlsym_addr_vmspace_acquire_ref                    0x0043DD40
#define kdlsym_addr_vmspace_alloc                          0x0043D8C0
#define kdlsym_addr_vmspace_free                           0x0043DB70
#define kdlsym_addr_vn_fullpath                            0x001B46B0
#define kdlsym_addr_vsnprintf                              0x00347900
#define kdlsym_addr_wakeup                                 0x0008A7C0
#define kdlsym_addr_Xfast_syscall                          0x0030EB30

// PS4GDB
#define kdlsym_addr_bzero                                  0xDEADC0DEDEADBEEF
#define kdlsym_addr_sys_getpid                             0xDEADC0DEDEADBEEF
#define kdlsym_addr_sys_sysctl                             0xDEADC0DEDEADBEEF

// Kernel Hooks
#define kdlsym_addr_printf_hook                            0x018876A8

// FakeSelf hooks
#define kdlsym_addr_sceSblAuthMgrIsLoadable__sceSblACMgrGetPathId_hook        0x0061185C
#define kdlsym_addr_sceSblAuthMgrIsLoadable2_hook                             0x006119B5
#define kdlsym_addr_sceSblAuthMgrSmLoadSelfSegment__sceSblServiceMailbox_hook 0x00616A5E
#define kdlsym_addr_sceSblAuthMgrSmLoadSelfBlock__sceSblServiceMailbox_hook   0x006176C4
#define kdlsym_addr_sceSblAuthMgrVerifyHeader_hookA                           0x00612149
#define kdlsym_addr_sceSblAuthMgrVerifyHeader_hookB                           0x00612D81

// FakePkg hooks
#define kdlsym_addr_sceSblKeymgrSetKeyStorage__sceSblDriverSendMsg_hook       0x0
#define kdlsym_addr_sceSblKeymgrInvalidateKey__sx_xlock_hook                  0x005FFBDA
#define kdlsym_addr_npdrm_decrypt_isolated_rif__sceSblKeymgrSmCallfunc_hook   0x0061FDB0
#define kdlsym_addr_npdrm_decrypt_rif_new__sceSblKeymgrSmCallfunc_hook        0x006202FF
#define kdlsym_addr_mountpfs__sceSblPfsSetKeys_hookA                          0x0
#define kdlsym_addr_mountpfs__sceSblPfsSetKeys_hookB                          0x0

// sceRegMgr
#define kdlsym_addr_sceRegMgrGetInt                        0x004CF9C0
#define kdlsym_addr_sceRegMgrSetInt                        0x004CEAB0
#define kdlsym_addr_sceRegMgrGetBin                        0x004D0330
#define kdlsym_addr_sceRegMgrSetBin                        0x004D0260
#define kdlsym_addr_sceRegMgrGetStr                        0x004D0140
#define kdlsym_addr_sceRegMgrSetStr                        0x004CFD90

// SceShellCore patches - call sceKernelIsGenuineCEX
#define ssc_sceKernelIsGenuineCEX_patchA                   0x0011A0DB
#define ssc_sceKernelIsGenuineCEX_patchB                   0x0066EA3B
#define ssc_sceKernelIsGenuineCEX_patchC                   0x007F554B
//#define ssc_sceKernelIsGenuineCEX_patchD                   0x0

// SceShellCore patches - call nidf_libSceDipsw
#define ssc_nidf_libSceDipsw_patchA                        0x0011A107
#define ssc_nidf_libSceDipsw_patchB                        0x0066EA67
#define ssc_nidf_libSceDipsw_patchC                        0x007F5577
//#define ssc_nidf_libSceDipsw_patchD                        0x0

#define ssc_enable_fakepkg_patch                           0x0032F8F3

// SceShellCore patches - use free prefix instead fake
#define ssc_fake_to_free_patch                             0x00C980EE

// SceShellCore patches - enable remote pkg installer
#define ssc_enable_data_mount_patch                        0x00276A7C

// SceShellCore patches - enable VR without spoof
#define ssc_enable_vr_patch                                0x00AA0590

// SceShellCore patches - enable official external HDD support (Support added in 4.50)
//#define ssc_external_hdd_pkg_installer_patch               0x0
//#define ssc_external_hdd_version_patch                     0x0

// SceShellUI patches - debug patches
#define ssu_sceSblRcMgrIsAllowDebugMenuForSettings_patch   0x000198C0
#define ssu_sceSblRcMgrIsStoreMode_patch                   0x00019BC0

// SceShellUI - remote play related patching
#define ssu_CreateUserForIDU_patch                         0x0017F330
#define ssu_remote_play_menu_patch                         0x011A8CF5

// SceRemotePlay - enabler patches
#define srp_enabler_patchA                                 0x00065ED2
#define srp_enabler_patchB                                 0x00065EED

#endif


code:
#pragma once
#include <Boot/Config.hpp>

// Offsets ported by Crazyvoid - Updated by SiSTRo

#if MIRA_PLATFORM == MIRA_PLATFORM_ORBIS_BSD_455
/*
These are the required functions in order for the Oni Framework to operate properly
These are all offsets into the base of the kernel. They expect all standard FreeBSD 9 prototypes

The reason we do not hardcode offsets here, is due to the different platforms that are supported, and
for the platforms that do enable kernel ASLR (Address Space Layout Randomization?)
*/

#define kdlsym_addr__mtx_lock_flags                        0x0030D6A0
#define kdlsym_addr__mtx_lock_sleep                        0x0030D710
#define kdlsym_addr__mtx_lock_spin_flags                   0x0030DA70
#define kdlsym_addr__mtx_unlock_flags                      0x0030D940
#define kdlsym_addr__mtx_unlock_sleep                      0x0030DA10
#define kdlsym_addr__mtx_unlock_spin_flags                 0x0030DC30
#define kdlsym_addr__sceSblAuthMgrGetSelfInfo              0x00626490
#define kdlsym_addr__sceSblAuthMgrSmStart                  0x00622020
#define kdlsym_addr__sx_init_flags                         0x0038F900
#define kdlsym_addr__sx_slock                              0x0038F980
#define kdlsym_addr__sx_sunlock                            0x0038FB00
#define kdlsym_addr__sx_xlock                              0x0038FA30
#define kdlsym_addr__sx_xunlock                            0x0038FBC0
#define kdlsym_addr__thread_lock_flags                     0x0030DD70
#define kdlsym_addr__vm_map_lock_read                      0x003920B0
#define kdlsym_addr__vm_map_unlock_read                    0x00392100
#define kdlsym_addr_AesCbcCfb128Decrypt                    0x0017A6F0
#define kdlsym_addr_AesCbcCfb128Encrypt                    0x0017A4C0
#define kdlsym_addr_allproc                                0x01AD7718
#define kdlsym_addr_allproc_lock                           0x01AD76B8
#define kdlsym_addr_avcontrol_sleep                        0x006C42E0
#define kdlsym_addr_cloneuio                               0x00040420
#define kdlsym_addr_console_cdev                           0x01A6CB08
#define kdlsym_addr_console_write                          0x00030630
#define kdlsym_addr_contigfree                             0x00250620
#define kdlsym_addr_contigmalloc                           0x002502C0
#define kdlsym_addr_copyin                                 0x0014A890
#define kdlsym_addr_copyinstr                              0x0014AD00
#define kdlsym_addr_copyout                                0x0014A7B0
#define kdlsym_addr_critical_enter                         0x0023D560
#define kdlsym_addr_critical_exit                          0x0023D570
#define kdlsym_addr_deci_tty_write                         0x00474E40
#define kdlsym_addr_destroy_dev                            0x0036EAD0
//#define kdlsym_addr_dmem_start_app_process                 0x0
#define kdlsym_addr_dynlib_do_dlsym                        0x00066A20
#define kdlsym_addr_dynlib_find_obj_by_handle              0x00067AD0
#define kdlsym_addr_eventhandler_deregister                0x003C9B60
#define kdlsym_addr_eventhandler_find_list                 0x003C9D50
#define kdlsym_addr_eventhandler_register                  0x003C97F0
#define kdlsym_addr_exec_new_vmspace                       0x002E8850
#define kdlsym_addr_faultin                                0x0030EE10
#define kdlsym_addr_fget_unlocked                          0x0042D160
#define kdlsym_addr_fpu_kern_ctx                           0x0251CCC0
#define kdlsym_addr_fpu_kern_enter                         0x00059580
#define kdlsym_addr_fpu_kern_leave                         0x00059680
#define kdlsym_addr_free                                   0x003F7930
#define kdlsym_addr_gdt                                    0x01B55AD0
#define kdlsym_addr_gpu_va_page_list                       0x02519DD0
#define kdlsym_addr_icc_nvs_read                           0x0001B850
#define kdlsym_addr_kern_close                             0x0042AC10
#define kdlsym_addr_kern_ioctl                             0x0005FA20
#define kdlsym_addr_kern_mkdirat                           0x00444E60
#define kdlsym_addr_kern_open                              0x0043FD00
#define kdlsym_addr_kern_openat                            0x0043FD60
#define kdlsym_addr_kern_readv                             0x0005ED30
#define kdlsym_addr_kern_reboot                            0x000998A0
#define kdlsym_addr_kern_sysents                           0x0102B690
#define kdlsym_addr_kern_thr_create                        0x002ECCD0
#define kdlsym_addr_kernel_map                             0x01B31218
#define kdlsym_addr_kernel_mount                           0x000DD1C0
#define kdlsym_addr_killproc                               0x00026230
#define kdlsym_addr_kmem_alloc                             0x0016ECD0
#define kdlsym_addr_kmem_free                              0x0016EEA0
#define kdlsym_addr_kproc_create                           0x00464700
#define kdlsym_addr_kproc_exit                             0x00464980
#define kdlsym_addr_kthread_add                            0x00464C90
#define kdlsym_addr_kthread_exit                           0x00464F60
#define kdlsym_addr_M_IOV                                  0x014447F0
#define kdlsym_addr_M_LINKER                               0x0144A320
#define kdlsym_addr_M_MOUNT                                0x0144F2A0
#define kdlsym_addr_M_TEMP                                 0x01993B30
#define kdlsym_addr_make_dev_p                             0x0036E5A0
#define kdlsym_addr_malloc                                 0x003F7750
#define kdlsym_addr_memcmp                                 0x00242A60
#define kdlsym_addr_memcpy                                 0x0014A6B0
#define kdlsym_addr_memmove                                0x002EE740
#define kdlsym_addr_memset                                 0x00302BD0
#define kdlsym_addr_mini_syscore_self_binary               0x01471468
#define kdlsym_addr_mount_arg                              0x000DCF40
#define kdlsym_addr_mount_argb                             0x000DB4E0
#define kdlsym_addr_mount_argf                             0x000DD020
#define kdlsym_addr_mtx_destroy                            0x0030E130
#define kdlsym_addr_mtx_init                               0x0030E0C0
#define kdlsym_addr_mtx_lock_sleep                         0x0030D710
#define kdlsym_addr_mtx_unlock_sleep                       0x0030DA10
#define kdlsym_addr_name_to_nids                           0x00069730
#define kdlsym_addr_pause                                  0x00261120
#define kdlsym_addr_pfind                                  0x00079780
#define kdlsym_addr_pmap_activate                          0x00427530
#define kdlsym_addr_printf                                 0x00017F30
#define kdlsym_addr_prison0                                0x010399B0
#define kdlsym_addr_proc0                                  0x01B2FC00
#define kdlsym_addr_proc_reparent                          0x0015C3C0
#define kdlsym_addr_proc_rwmem                             0x0017CB70
#define kdlsym_addr_realloc                                0x003F7A60
#define kdlsym_addr_rootvnode                              0x021AFA30
#define kdlsym_addr_RsaesPkcs1v15Dec2048CRT                0x003EF200
#define kdlsym_addr_sbl_eap_internal_partition_key         0x0258CCD0
#define kdlsym_addr_sbl_keymgr_buf_gva                     0x02538200
#define kdlsym_addr_sbl_keymgr_buf_va                      0x02538000
#define kdlsym_addr_sbl_keymgr_key_rbtree                  0x02534DE0
#define kdlsym_addr_sbl_keymgr_key_slots                   0x02534DD0
#define kdlsym_addr_sbl_pfs_sx                             0x0
#define kdlsym_addr_sbl_drv_msg_mtx                        0x02519DD8
#define kdlsym_addr_sceSblACMgrGetPathId                   0x0016A5E0
#define kdlsym_addr_sceSblAuthMgrIsLoadable2               0x00625C50
#define kdlsym_addr_sceSblAuthMgrSmVerifyHeader            0x00623250
#define kdlsym_addr_sceSblAuthMgrVerifyHeader              0x00625CB0
#define kdlsym_addr_sceSblDriverSendMsg                    0x00601670
#define kdlsym_addr_sceSblGetEAPInternalPartitionKey       0x00609D20
#define kdlsym_addr_sceSblKeymgrClearKey                   0x0060DF40
#define kdlsym_addr_sceSblKeymgrSetKeyForPfs               0x0060DD70
#define kdlsym_addr_sceSblKeymgrSetKeyStorage              0x0
#define kdlsym_addr_sceSblKeymgrSmCallfunc                 0x0060E680
#define kdlsym_addr_sceSblPfsSetKeys                       0x00606E00
#define kdlsym_addr_sceSblRngGetRandomNumber               0x006298C0
#define kdlsym_addr_sceSblServiceMailbox                   0x006146C0
#define kdlsym_addr_self_orbis_sysvec                      0x01460610
#define kdlsym_addr_Sha256Hmac                             0x002D5C50
#define kdlsym_addr_snprintf                               0x00018230
#define kdlsym_addr_spinlock_exit                          0x002828D0
#define kdlsym_addr_sprintf                                0x00018160
#define kdlsym_addr_sscanf                                 0x00302100
#define kdlsym_addr_strcmp                                 0x001DAEF0
#define kdlsym_addr_strdup                                 0x00452A30
#define kdlsym_addr_strlen                                 0x003514F0
#define kdlsym_addr_strncmp                                0x003DB670
#define kdlsym_addr_strstr                                 0x00261710
#define kdlsym_addr_sys_accept                             0x003EBEC0
#define kdlsym_addr_sys_bind                               0x003EB550
#define kdlsym_addr_sys_close                              0x0042AC00
#define kdlsym_addr_sys_dup2                               0x00428E50
#define kdlsym_addr_sys_fstat                              0x0042B1B0
#define kdlsym_addr_sys_getdents                           0x00445600
#define kdlsym_addr_sys_kill                               0x00023CC0
#define kdlsym_addr_sys_listen                             0x003EB760
#define kdlsym_addr_sys_lseek                              0x00441D20
#define kdlsym_addr_sys_mkdir                              0x00444DE0
#define kdlsym_addr_sys_mlock                              0x00142A40
#define kdlsym_addr_sys_mlockall                           0x00142AF0
#define kdlsym_addr_sys_mmap                               0x001419F0
#define kdlsym_addr_sys_munmap                             0x00142190
#define kdlsym_addr_sys_nmount                             0x000D9B40
#define kdlsym_addr_sys_open                               0x0043FCE0
#define kdlsym_addr_sys_ptrace                             0x0017D000
#define kdlsym_addr_sys_read                               0x0005EC50
#define kdlsym_addr_sys_recvfrom                           0x003ED080
#define kdlsym_addr_sys_rmdir                              0x00445160
#define kdlsym_addr_sys_sendto                             0x003EC9C0
#define kdlsym_addr_sys_setuid                             0x00114450
#define kdlsym_addr_sys_shutdown                           0x003ED250
#define kdlsym_addr_sys_socket                             0x003EAC20
#define kdlsym_addr_sys_stat                               0x00442320
#define kdlsym_addr_sys_unlink                             0x00441730
#define kdlsym_addr_sys_unmount                            0x000DB500
#define kdlsym_addr_sys_wait4                              0x0015C500
#define kdlsym_addr_sys_write                              0x0005F1A0
#define kdlsym_addr_trap_fatal                             0x003DBD20
#define kdlsym_addr_utilUSleep                             0x0065F290
#define kdlsym_addr_vm_fault_disable_pagefaults            0x002A19F0
#define kdlsym_addr_vm_fault_enable_pagefaults             0x002A1A20
#define kdlsym_addr_vm_map_lookup_entry                    0x00392C70
#define kdlsym_addr_vmspace_acquire_ref                    0x00391EE0
#define kdlsym_addr_vmspace_alloc                          0x00391A70
#define kdlsym_addr_vmspace_free                           0x00391D10
#define kdlsym_addr_vn_fullpath                            0x002FB5B0
#define kdlsym_addr_vsnprintf                              0x000182D0
#define kdlsym_addr_wakeup                                 0x00261140
#define kdlsym_addr_Xfast_syscall                          0x003095D0

// PS4GDB
#define kdlsym_addr_bzero                                  0xDEADC0DEDEADBEEF
#define kdlsym_addr_sys_getpid                             0xDEADC0DEDEADBEEF
#define kdlsym_addr_sys_sysctl                             0xDEADC0DEDEADBEEF

// Kernel Hooks
#define kdlsym_addr_printf_hook                            0x0199BDC8

// FakeSelf hooks
#define kdlsym_addr_sceSblAuthMgrIsLoadable__sceSblACMgrGetPathId_hook        0x0061F0FC
#define kdlsym_addr_sceSblAuthMgrIsLoadable2_hook                             0x0061F24F
#define kdlsym_addr_sceSblAuthMgrSmLoadSelfSegment__sceSblServiceMailbox_hook 0x006238BA
#define kdlsym_addr_sceSblAuthMgrSmLoadSelfBlock__sceSblServiceMailbox_hook   0x006244E1
#define kdlsym_addr_sceSblAuthMgrVerifyHeader_hookA                           0x0061F976
#define kdlsym_addr_sceSblAuthMgrVerifyHeader_hookB                           0x00620599

// FakePkg hooks
#define kdlsym_addr_sceSblKeymgrSetKeyStorage__sceSblDriverSendMsg_hook       0x0
#define kdlsym_addr_sceSblKeymgrInvalidateKey__sx_xlock_hook                  0x0060ED5A
#define kdlsym_addr_npdrm_decrypt_isolated_rif__sceSblKeymgrSmCallfunc_hook   0x0062DF00
#define kdlsym_addr_npdrm_decrypt_rif_new__sceSblKeymgrSmCallfunc_hook        0x0062ECDE
#define kdlsym_addr_mountpfs__sceSblPfsSetKeys_hookA                          0x0
#define kdlsym_addr_mountpfs__sceSblPfsSetKeys_hookB                          0x0

// sceRegMgr
#define kdlsym_addr_sceRegMgrGetInt                        0x004D7DB0
#define kdlsym_addr_sceRegMgrSetInt                        0x004D6F00
#define kdlsym_addr_sceRegMgrGetBin                        0x004D8710
#define kdlsym_addr_sceRegMgrSetBin                        0x004D8640
#define kdlsym_addr_sceRegMgrGetStr                        0x004D8520
#define kdlsym_addr_sceRegMgrSetStr                        0x004D8170

// SceShellCore patches - call sceKernelIsGenuineCEX
#define ssc_sceKernelIsGenuineCEX_patchA                   0x001486BB
#define ssc_sceKernelIsGenuineCEX_patchB                   0x006E523B
#define ssc_sceKernelIsGenuineCEX_patchC                   0x00852C6B
//#define ssc_sceKernelIsGenuineCEX_patchD                   0x0

// SceShellCore patches - call nidf_libSceDipsw
#define ssc_nidf_libSceDipsw_patchA                        0x001486E7
#define ssc_nidf_libSceDipsw_patchB                        0x006E5267
#define ssc_nidf_libSceDipsw_patchC                        0x00852C97
//#define ssc_nidf_libSceDipsw_patchD                        0x0

#define ssc_enable_fakepkg_patch                           0x00379573

// SceShellCore patches - use free prefix instead fake
#define ssc_fake_to_free_patch                             0x00D40F28

// SceShellCore patches - enable remote pkg installer
#define ssc_enable_data_mount_patch                        0x002C575C

// SceShellCore patches - enable VR without spoof
#define ssc_enable_vr_patch                                0x00B2D9B0

// SceShellCore patches - enable official external HDD support (Support added in 4.50)
#define ssc_external_hdd_pkg_installer_patch               0x00844821
#define ssc_external_hdd_version_patchA                    0x004F9F5D
#define ssc_external_hdd_version_patchB                    0x0011DDF1

// SceShellUI patches - debug patches
#define ssu_sceSblRcMgrIsAllowDebugMenuForSettings_patch   0x00019EA0
#define ssu_sceSblRcMgrIsStoreMode_patch                   0x0001A1A0

// SceShellUI - remote play related patching
#define ssu_CreateUserForIDU_patch                         0x00195820
#define ssu_remote_play_menu_patch                         0x01296867

// SceRemotePlay - enabler patches
#define srp_enabler_patchA                                 0x0003C882
#define srp_enabler_patchB                                 0x0003C89D

#endif